Rewindex/CVEs

CVE-2024-51378: CyberPanel Incorrect Default Permissions Vulnerability

Description

getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.

Vector CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N

Status incidents that name it

No tracked status incident names this CVE.

Affected vendors and products

cyberpanel: cyberpanel

References

• CVE record on cve.org (opens in new tab)
• NVD entry (opens in new tab)
• cwe.mitre.org/data/definitions/420.html (opens in new tab)
• cwe.mitre.org/data/definitions/78.html (opens in new tab)
• cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel (opens in new tab)
• cyberpanel.net/KnowledgeBase/home/change-logs/ (opens in new tab)
• github.com/usmannasir/cyberpanel/commit/1c0c6cbcf71abe573da0b5fddfb9603e7477f683 (opens in new tab)
• refr4g.github.io/posts/cyberpanel-command-injection-vulnerability/ (opens in new tab)
• www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpan… (opens in new tab)

All CVEsMarkdownJSON

• CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
• This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
• Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
• EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)